CVE-2026-102508: Apache PLC4X OPC UA driver cryptographic signature verification bypass

CVE-2026-102508 · Severity: info · Published 2026-09-30

Apache PLC4X is an open-source library for industrial device communication, widely used in manufacturing and IoT systems. The OPC UA driver contains multiple cryptographic verification flaws that allow an attacker positioned on the network between a client and server to impersonate the server, intercept credentials, and read or modify secure communications. Affected installations are vulnerable to credential theft and unauthorized control of connected industrial equipment.

Technologies: Apache PLC4X. Vendors: Apache.

Quick answers

Is CVE-2026-102508 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102508 being exploited in the wild.
How severe is CVE-2026-102508?
Informational severity, published 30 September 2026.
Which products and versions are affected?
Apache PLC4X 0.9.0 through 0.13.1.
Is there a fix for CVE-2026-102508?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102508 attacked?
It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-102508?
Check whether you run Apache PLC4X at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability involves multiple signature and certificate validation defects in the OPC UA driver: signature verification is either unenforced (0.9.0–0.11.0), inverted (0.12.0–0.13.1), or bypassed via silent fallback to weaker policies. Server certificates are not validated against a trust anchor by default, allowing MITM attacks. The default security policy is None across all versions. Exploitation requires network adjacency between client and server but grants immediate access to encrypted traffic and credentials without authentication.

Affected products

  • Apache PLC4X 0.9.0 through 0.13.1

Timeline

  • 2026-09-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.